The scale of the problem is still being measured. The Railway breach has not been fully characterized, and the number of affected workspaces is described as a maximum, not a confirmed count. Google's September 2026 research says AI agents are now automating parts of the credential theft pipeline, but the report does not quantify how much of the activity is automated. CrowdStrike's 2026 Threat Hunting Report counts an 89% rise in AI-related adversary activity from July 2025 to June 2026. Okta found hundreds of unexpired AI-service tokens in a September 2026 infostealer log dump. Google expects attackers to prioritize these targets as legitimate AI demand grows.
Security teams should treat any unauthorized change to an AI account as a critical incident, not a billing anomaly. Audit where API keys and cloud credentials sit in project environment variables, since that is where Zeabur's attackers found them. Google recommends issuing short-lived, narrowly scoped credentials to AI agents rather than long-lived keys. The March 2026 compromise of the LiteLLM gateway library (CVE-2026-33634), which exposed provider credentials across organizations, shows that third-party dependencies in AI tooling are part of the attack surface. Check whether your organization uses LiteLLM and whether those credentials were rotated.